CompTIA SecAI+

Each stage of building an AI system creates its own risk. You follow data from collection through training, validation, deployment and monitoring, and note who touches it and what could go wrong.

• Data collection, labeling and preparation
• Training, validation and testing
• Model registries and deployment
• Serving models through APIs
• Monitoring, drift and retraining
• Mapping stakeholders and trust boundaries

You build A life cycle diagram for one AI system with the security exposure marked at each stage.

Attacks on AI systems have their own vocabulary. You study poisoning, evasion, extraction and inference attacks on models, and prompt injection and related weaknesses in language-model applications.

• Data poisoning and backdoors
• Adversarial examples and evasion
• Model extraction and inversion
• Membership inference and data leakage
• Prompt injection and jailbreaks
• Insecure output handling and excessive agency
• Threat catalogs for AI: OWASP and MITRE ATLAS

You build A threat model for one language-model application, with each threat mapped to a catalog entry.

A model is only as trustworthy as its data. You control access to training data, verify its provenance and integrity, and apply privacy techniques so training does not expose what it learns from.

• Data provenance and integrity checks
• Access control and encryption for datasets
• Anonymization and synthetic data
• Differential privacy in outline
• Securing labeling and annotation work
• Protecting training environments

You build A data protection plan for a training pipeline, with integrity checks and access rules.

Deployed models are services that can be abused. You protect model files and registries, control access to inference, apply guardrails and test them by attacking your own system.

• Model signing and supply chain checks
• Authentication, authorization and rate limits for model APIs
• Input and output filtering guardrails
• Isolating tools and agent permissions
• Securing GPU and container infrastructure
• Red teaming a model application
• Logging for investigation and abuse detection

You build A hardened deployment design for a model API, with guardrails and a red team test plan.

Attackers now use AI to scale their work. You recognize generated phishing, synthetic voice and video, and automated reconnaissance, and put verification and detection controls in front of them.

• AI-generated phishing and social engineering
• Deepfake audio and video fraud
• Automated reconnaissance and vulnerability discovery
• AI-assisted malware development
• Verification procedures that survive synthetic media
• Updating awareness training

You build A set of verification procedures for high-value requests, tested against synthetic examples.

AI helps with volume and also with mistakes. You apply it to triage, anomaly detection, log analysis and threat intelligence, and set the checks that keep a human accountable for each decision.

• Anomaly detection and behavioral analytics
• Alert triage and summarization
• Threat intelligence analysis with language models
• Phishing and malware classification
• Hallucination, bias and over-reliance
• Measuring whether an AI tool actually helps

You build An evaluation of an AI triage assistant against a sample of real alerts, with error analysis.

Automation speeds a response and magnifies its errors. You add AI to playbooks and orchestration for enrichment, drafting and routine actions, and decide which steps must always wait for a person.

• Orchestration with AI-assisted steps
• Automated enrichment and report drafting
• Agents that take action and their limits
• Approval gates and rollback
• Auditing automated decisions
• Failure modes during an incident

You build An incident playbook with AI-assisted steps, approval gates and an audit log.

Code assistants change how software is written and how it fails. You review generated code for insecure patterns and leaked secrets, apply AI to scanning and review, and secure the pipeline that ships AI features.

• Risks of AI-generated code
• Secrets and data leakage through assistants
• Dependency risks, including invented package names
• AI-assisted code scanning and review
• Secure development for AI applications
• Inventory of models, datasets and dependencies

You build A secure development checklist for a team that uses code assistants, with pipeline checks.

Governance decides who may use AI for what. You set acceptable use rules, define ownership and oversight, keep an inventory of models and shadow use, and cover transparency, bias and explainability.

• Governance bodies, roles and accountability
• Acceptable use policy for AI
• Model and use case inventory
• Shadow AI and how to find it
• Transparency, explainability and human oversight
• Bias, fairness and ethical review

You build An AI acceptable use policy and use case approval process for one organization.

AI risk is assessed per use case, not once. You apply a recognized risk management framework, assess the risk of vendors and third-party models, and record the risks, owners and treatments.

• The NIST AI Risk Management Framework
• Assessing risk for a specific AI use case
• Third-party models and vendor assessment
• Risks to confidentiality, integrity and availability
• Residual risk and acceptance
• Building an AI risk register

You build A completed risk assessment for one AI use case and its vendor.

AI sits under privacy, intellectual property and new AI-specific rules. You map obligations to a use case, work with risk tiers and management system standards, and prepare the evidence an auditor will ask for.

• AI regulation and risk tiers, including the EU AI Act
• Privacy law applied to training and inference
• Intellectual property and copyright exposure
• Management system standards for AI
• Documentation, logging and audit evidence
• Incident reporting duties

You build A compliance map for one AI system, listing obligations, controls and evidence.

One deployment ties the domains together. You model its threats, secure its data and model, add AI to its monitoring, write the governance around it and assess its risk and compliance.

• Scoping the AI system and its stakeholders
• Modeling threats and choosing controls
• Planning monitoring and response
• Writing governance and risk documents
• Presenting residual risk to leadership

You build A security and governance package for one AI deployment: threats, controls, policy and risk record.